GHSA-2fx6-r6qx-3c7hMediumCVSS 6.5

Path Traversal in Apache Oozie

Published
May 14, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2017-15712 →

📋 Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.

🎯 Affected products1

  • maven/org.apache.oozie:oozie-core:>= 3.1.3, < 5.0.0

🔗 References (4)